1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This file is part of UBIFS.
4 *
5 * Copyright (C) 2006-2008 Nokia Corporation.
6 *
7 * Authors: Artem Bityutskiy (���������������� ����������)
8 *          Adrian Hunter
9 */
10
11/* This file implements reading and writing the master node */
12
13#include "ubifs.h"
14
15/**
16 * ubifs_compare_master_node - compare two UBIFS master nodes
17 * @c: UBIFS file-system description object
18 * @m1: the first node
19 * @m2: the second node
20 *
21 * This function compares two UBIFS master nodes. Returns 0 if they are equal
22 * and nonzero if not.
23 */
24int ubifs_compare_master_node(struct ubifs_info *c, void *m1, void *m2)
25{
26	int ret;
27	int behind;
28	int hmac_offs = offsetof(struct ubifs_mst_node, hmac);
29
30	/*
31	 * Do not compare the common node header since the sequence number and
32	 * hence the CRC are different.
33	 */
34	ret = memcmp(m1 + UBIFS_CH_SZ, m2 + UBIFS_CH_SZ,
35		     hmac_offs - UBIFS_CH_SZ);
36	if (ret)
37		return ret;
38
39	/*
40	 * Do not compare the embedded HMAC as well which also must be different
41	 * due to the different common node header.
42	 */
43	behind = hmac_offs + UBIFS_MAX_HMAC_LEN;
44
45	if (UBIFS_MST_NODE_SZ > behind)
46		return memcmp(m1 + behind, m2 + behind, UBIFS_MST_NODE_SZ - behind);
47
48	return 0;
49}
50
51/* mst_node_check_hash - Check hash of a master node
52 * @c: UBIFS file-system description object
53 * @mst: The master node
54 * @expected: The expected hash of the master node
55 *
56 * This checks the hash of a master node against a given expected hash.
57 * Note that we have two master nodes on a UBIFS image which have different
58 * sequence numbers and consequently different CRCs. To be able to match
59 * both master nodes we exclude the common node header containing the sequence
60 * number and CRC from the hash.
61 *
62 * Returns 0 if the hashes are equal, a negative error code otherwise.
63 */
64static int mst_node_check_hash(const struct ubifs_info *c,
65			       const struct ubifs_mst_node *mst,
66			       const u8 *expected)
67{
68	u8 calc[UBIFS_MAX_HASH_LEN];
69	const void *node = mst;
70
71	crypto_shash_tfm_digest(c->hash_tfm, node + sizeof(struct ubifs_ch),
72				UBIFS_MST_NODE_SZ - sizeof(struct ubifs_ch),
73				calc);
74
75	if (ubifs_check_hash(c, expected, calc))
76		return -EPERM;
77
78	return 0;
79}
80
81/**
82 * scan_for_master - search the valid master node.
83 * @c: UBIFS file-system description object
84 *
85 * This function scans the master node LEBs and search for the latest master
86 * node. Returns zero in case of success, %-EUCLEAN if there master area is
87 * corrupted and requires recovery, and a negative error code in case of
88 * failure.
89 */
90static int scan_for_master(struct ubifs_info *c)
91{
92	struct ubifs_scan_leb *sleb;
93	struct ubifs_scan_node *snod;
94	int lnum, offs = 0, nodes_cnt, err;
95
96	lnum = UBIFS_MST_LNUM;
97
98	sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
99	if (IS_ERR(sleb))
100		return PTR_ERR(sleb);
101	nodes_cnt = sleb->nodes_cnt;
102	if (nodes_cnt > 0) {
103		snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node,
104				  list);
105		if (snod->type != UBIFS_MST_NODE)
106			goto out_dump;
107		memcpy(c->mst_node, snod->node, snod->len);
108		offs = snod->offs;
109	}
110	ubifs_scan_destroy(sleb);
111
112	lnum += 1;
113
114	sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
115	if (IS_ERR(sleb))
116		return PTR_ERR(sleb);
117	if (sleb->nodes_cnt != nodes_cnt)
118		goto out;
119	if (!sleb->nodes_cnt)
120		goto out;
121	snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, list);
122	if (snod->type != UBIFS_MST_NODE)
123		goto out_dump;
124	if (snod->offs != offs)
125		goto out;
126	if (ubifs_compare_master_node(c, c->mst_node, snod->node))
127		goto out;
128
129	c->mst_offs = offs;
130	ubifs_scan_destroy(sleb);
131
132	if (!ubifs_authenticated(c))
133		return 0;
134
135	if (ubifs_hmac_zero(c, c->mst_node->hmac)) {
136		err = mst_node_check_hash(c, c->mst_node,
137					  c->sup_node->hash_mst);
138		if (err)
139			ubifs_err(c, "Failed to verify master node hash");
140	} else {
141		err = ubifs_node_verify_hmac(c, c->mst_node,
142					sizeof(struct ubifs_mst_node),
143					offsetof(struct ubifs_mst_node, hmac));
144		if (err)
145			ubifs_err(c, "Failed to verify master node HMAC");
146	}
147
148	if (err)
149		return -EPERM;
150
151	return 0;
152
153out:
154	ubifs_scan_destroy(sleb);
155	return -EUCLEAN;
156
157out_dump:
158	ubifs_err(c, "unexpected node type %d master LEB %d:%d",
159		  snod->type, lnum, snod->offs);
160	ubifs_scan_destroy(sleb);
161	return -EINVAL;
162}
163
164/**
165 * validate_master - validate master node.
166 * @c: UBIFS file-system description object
167 *
168 * This function validates data which was read from master node. Returns zero
169 * if the data is all right and %-EINVAL if not.
170 */
171static int validate_master(const struct ubifs_info *c)
172{
173	long long main_sz;
174	int err;
175
176	if (c->max_sqnum >= SQNUM_WATERMARK) {
177		err = 1;
178		goto out;
179	}
180
181	if (c->cmt_no >= c->max_sqnum) {
182		err = 2;
183		goto out;
184	}
185
186	if (c->highest_inum >= INUM_WATERMARK) {
187		err = 3;
188		goto out;
189	}
190
191	if (c->lhead_lnum < UBIFS_LOG_LNUM ||
192	    c->lhead_lnum >= UBIFS_LOG_LNUM + c->log_lebs ||
193	    c->lhead_offs < 0 || c->lhead_offs >= c->leb_size ||
194	    c->lhead_offs & (c->min_io_size - 1)) {
195		err = 4;
196		goto out;
197	}
198
199	if (c->zroot.lnum >= c->leb_cnt || c->zroot.lnum < c->main_first ||
200	    c->zroot.offs >= c->leb_size || c->zroot.offs & 7) {
201		err = 5;
202		goto out;
203	}
204
205	if (c->zroot.len < c->ranges[UBIFS_IDX_NODE].min_len ||
206	    c->zroot.len > c->ranges[UBIFS_IDX_NODE].max_len) {
207		err = 6;
208		goto out;
209	}
210
211	if (c->gc_lnum >= c->leb_cnt || c->gc_lnum < c->main_first) {
212		err = 7;
213		goto out;
214	}
215
216	if (c->ihead_lnum >= c->leb_cnt || c->ihead_lnum < c->main_first ||
217	    c->ihead_offs % c->min_io_size || c->ihead_offs < 0 ||
218	    c->ihead_offs > c->leb_size || c->ihead_offs & 7) {
219		err = 8;
220		goto out;
221	}
222
223	main_sz = (long long)c->main_lebs * c->leb_size;
224	if (c->bi.old_idx_sz & 7 || c->bi.old_idx_sz >= main_sz) {
225		err = 9;
226		goto out;
227	}
228
229	if (c->lpt_lnum < c->lpt_first || c->lpt_lnum > c->lpt_last ||
230	    c->lpt_offs < 0 || c->lpt_offs + c->nnode_sz > c->leb_size) {
231		err = 10;
232		goto out;
233	}
234
235	if (c->nhead_lnum < c->lpt_first || c->nhead_lnum > c->lpt_last ||
236	    c->nhead_offs < 0 || c->nhead_offs % c->min_io_size ||
237	    c->nhead_offs > c->leb_size) {
238		err = 11;
239		goto out;
240	}
241
242	if (c->ltab_lnum < c->lpt_first || c->ltab_lnum > c->lpt_last ||
243	    c->ltab_offs < 0 ||
244	    c->ltab_offs + c->ltab_sz > c->leb_size) {
245		err = 12;
246		goto out;
247	}
248
249	if (c->big_lpt && (c->lsave_lnum < c->lpt_first ||
250	    c->lsave_lnum > c->lpt_last || c->lsave_offs < 0 ||
251	    c->lsave_offs + c->lsave_sz > c->leb_size)) {
252		err = 13;
253		goto out;
254	}
255
256	if (c->lscan_lnum < c->main_first || c->lscan_lnum >= c->leb_cnt) {
257		err = 14;
258		goto out;
259	}
260
261	if (c->lst.empty_lebs < 0 || c->lst.empty_lebs > c->main_lebs - 2) {
262		err = 15;
263		goto out;
264	}
265
266	if (c->lst.idx_lebs < 0 || c->lst.idx_lebs > c->main_lebs - 1) {
267		err = 16;
268		goto out;
269	}
270
271	if (c->lst.total_free < 0 || c->lst.total_free > main_sz ||
272	    c->lst.total_free & 7) {
273		err = 17;
274		goto out;
275	}
276
277	if (c->lst.total_dirty < 0 || (c->lst.total_dirty & 7)) {
278		err = 18;
279		goto out;
280	}
281
282	if (c->lst.total_used < 0 || (c->lst.total_used & 7)) {
283		err = 19;
284		goto out;
285	}
286
287	if (c->lst.total_free + c->lst.total_dirty +
288	    c->lst.total_used > main_sz) {
289		err = 20;
290		goto out;
291	}
292
293	if (c->lst.total_dead + c->lst.total_dark +
294	    c->lst.total_used + c->bi.old_idx_sz > main_sz) {
295		err = 21;
296		goto out;
297	}
298
299	if (c->lst.total_dead < 0 ||
300	    c->lst.total_dead > c->lst.total_free + c->lst.total_dirty ||
301	    c->lst.total_dead & 7) {
302		err = 22;
303		goto out;
304	}
305
306	if (c->lst.total_dark < 0 ||
307	    c->lst.total_dark > c->lst.total_free + c->lst.total_dirty ||
308	    c->lst.total_dark & 7) {
309		err = 23;
310		goto out;
311	}
312
313	return 0;
314
315out:
316	ubifs_err(c, "bad master node at offset %d error %d", c->mst_offs, err);
317	ubifs_dump_node(c, c->mst_node, c->mst_node_alsz);
318	return -EINVAL;
319}
320
321/**
322 * ubifs_read_master - read master node.
323 * @c: UBIFS file-system description object
324 *
325 * This function finds and reads the master node during file-system mount. If
326 * the flash is empty, it creates default master node as well. Returns zero in
327 * case of success and a negative error code in case of failure.
328 */
329int ubifs_read_master(struct ubifs_info *c)
330{
331	int err, old_leb_cnt;
332
333	c->mst_node = kzalloc(c->mst_node_alsz, GFP_KERNEL);
334	if (!c->mst_node)
335		return -ENOMEM;
336
337	err = scan_for_master(c);
338	if (err) {
339		if (err == -EUCLEAN)
340			err = ubifs_recover_master_node(c);
341		if (err)
342			/*
343			 * Note, we do not free 'c->mst_node' here because the
344			 * unmount routine will take care of this.
345			 */
346			return err;
347	}
348
349	/* Make sure that the recovery flag is clear */
350	c->mst_node->flags &= cpu_to_le32(~UBIFS_MST_RCVRY);
351
352	c->max_sqnum       = le64_to_cpu(c->mst_node->ch.sqnum);
353	c->highest_inum    = le64_to_cpu(c->mst_node->highest_inum);
354	c->cmt_no          = le64_to_cpu(c->mst_node->cmt_no);
355	c->zroot.lnum      = le32_to_cpu(c->mst_node->root_lnum);
356	c->zroot.offs      = le32_to_cpu(c->mst_node->root_offs);
357	c->zroot.len       = le32_to_cpu(c->mst_node->root_len);
358	c->lhead_lnum      = le32_to_cpu(c->mst_node->log_lnum);
359	c->gc_lnum         = le32_to_cpu(c->mst_node->gc_lnum);
360	c->ihead_lnum      = le32_to_cpu(c->mst_node->ihead_lnum);
361	c->ihead_offs      = le32_to_cpu(c->mst_node->ihead_offs);
362	c->bi.old_idx_sz   = le64_to_cpu(c->mst_node->index_size);
363	c->lpt_lnum        = le32_to_cpu(c->mst_node->lpt_lnum);
364	c->lpt_offs        = le32_to_cpu(c->mst_node->lpt_offs);
365	c->nhead_lnum      = le32_to_cpu(c->mst_node->nhead_lnum);
366	c->nhead_offs      = le32_to_cpu(c->mst_node->nhead_offs);
367	c->ltab_lnum       = le32_to_cpu(c->mst_node->ltab_lnum);
368	c->ltab_offs       = le32_to_cpu(c->mst_node->ltab_offs);
369	c->lsave_lnum      = le32_to_cpu(c->mst_node->lsave_lnum);
370	c->lsave_offs      = le32_to_cpu(c->mst_node->lsave_offs);
371	c->lscan_lnum      = le32_to_cpu(c->mst_node->lscan_lnum);
372	c->lst.empty_lebs  = le32_to_cpu(c->mst_node->empty_lebs);
373	c->lst.idx_lebs    = le32_to_cpu(c->mst_node->idx_lebs);
374	old_leb_cnt        = le32_to_cpu(c->mst_node->leb_cnt);
375	c->lst.total_free  = le64_to_cpu(c->mst_node->total_free);
376	c->lst.total_dirty = le64_to_cpu(c->mst_node->total_dirty);
377	c->lst.total_used  = le64_to_cpu(c->mst_node->total_used);
378	c->lst.total_dead  = le64_to_cpu(c->mst_node->total_dead);
379	c->lst.total_dark  = le64_to_cpu(c->mst_node->total_dark);
380
381	ubifs_copy_hash(c, c->mst_node->hash_root_idx, c->zroot.hash);
382
383	c->calc_idx_sz = c->bi.old_idx_sz;
384
385	if (c->mst_node->flags & cpu_to_le32(UBIFS_MST_NO_ORPHS))
386		c->no_orphs = 1;
387
388	if (old_leb_cnt != c->leb_cnt) {
389		/* The file system has been resized */
390		int growth = c->leb_cnt - old_leb_cnt;
391
392		if (c->leb_cnt < old_leb_cnt ||
393		    c->leb_cnt < UBIFS_MIN_LEB_CNT) {
394			ubifs_err(c, "bad leb_cnt on master node");
395			ubifs_dump_node(c, c->mst_node, c->mst_node_alsz);
396			return -EINVAL;
397		}
398
399		dbg_mnt("Auto resizing (master) from %d LEBs to %d LEBs",
400			old_leb_cnt, c->leb_cnt);
401		c->lst.empty_lebs += growth;
402		c->lst.total_free += growth * (long long)c->leb_size;
403		c->lst.total_dark += growth * (long long)c->dark_wm;
404
405		/*
406		 * Reflect changes back onto the master node. N.B. the master
407		 * node gets written immediately whenever mounting (or
408		 * remounting) in read-write mode, so we do not need to write it
409		 * here.
410		 */
411		c->mst_node->leb_cnt = cpu_to_le32(c->leb_cnt);
412		c->mst_node->empty_lebs = cpu_to_le32(c->lst.empty_lebs);
413		c->mst_node->total_free = cpu_to_le64(c->lst.total_free);
414		c->mst_node->total_dark = cpu_to_le64(c->lst.total_dark);
415	}
416
417	err = validate_master(c);
418	if (err)
419		return err;
420
421	err = dbg_old_index_check_init(c, &c->zroot);
422
423	return err;
424}
425
426/**
427 * ubifs_write_master - write master node.
428 * @c: UBIFS file-system description object
429 *
430 * This function writes the master node. Returns zero in case of success and a
431 * negative error code in case of failure. The master node is written twice to
432 * enable recovery.
433 */
434int ubifs_write_master(struct ubifs_info *c)
435{
436	int err, lnum, offs, len;
437
438	ubifs_assert(c, !c->ro_media && !c->ro_mount);
439	if (c->ro_error)
440		return -EROFS;
441
442	lnum = UBIFS_MST_LNUM;
443	offs = c->mst_offs + c->mst_node_alsz;
444	len = UBIFS_MST_NODE_SZ;
445
446	if (offs + UBIFS_MST_NODE_SZ > c->leb_size) {
447		err = ubifs_leb_unmap(c, lnum);
448		if (err)
449			return err;
450		offs = 0;
451	}
452
453	c->mst_offs = offs;
454	c->mst_node->highest_inum = cpu_to_le64(c->highest_inum);
455
456	ubifs_copy_hash(c, c->zroot.hash, c->mst_node->hash_root_idx);
457	err = ubifs_write_node_hmac(c, c->mst_node, len, lnum, offs,
458				    offsetof(struct ubifs_mst_node, hmac));
459	if (err)
460		return err;
461
462	lnum += 1;
463
464	if (offs == 0) {
465		err = ubifs_leb_unmap(c, lnum);
466		if (err)
467			return err;
468	}
469	err = ubifs_write_node_hmac(c, c->mst_node, len, lnum, offs,
470				    offsetof(struct ubifs_mst_node, hmac));
471
472	return err;
473}
474